pawl

§ 1motivation

sato established a pattern. the contract is the issuer. the reserve is the proof. the math is the schedule. nothing can be governed, nothing can be withdrawn, nothing can be upgraded. these are not features of a particular implementation; they are the design.

but the reserve in sato is inert. ether deposited at mint time is ether sitting in a contract storage slot. the rest of ethereum compounds — through staking, through lending, through liquidity provision — and this single pool does not. it just waits.

pawl asks a small question. what if the reserve also compounds? specifically, what if every deposited ether is atomically wrapped into wsteth, and the curve scales with the wsteth peg?

the answer is that almost nothing changes. the curve shape is the same. mint and burn semantics are the same from a user's perspective. one scalar — the multiplier m — drifts upward over time at the lido staking rate. m scales the curve vertically. the bar for profitable issuance rises with m. holders who burn after years of dormancy receive more ether per token than they would have at deployment, even with no other transactions intervening.

this paper specifies pawl in detail sufficient to implement and audit.

§ 2the bonding curve

let q denote the cumulative quantity of tokens minted, and e the cumulative quantity of ether-equivalent booked by the curve. we adopt the saturating-issuance model used by sato. the rate equation is:

dq/de = (K − q) / S

each additional unit of ether mints a fraction (K − q)/S of new tokens, where K is the asymptotic supply cap and S is a parameter controlling the curve's steepness. each additional ether contributes less than the last, because q approaches K. integrating from (e = 0, q = 0):

q(e) = K · (1 − exp(−e/S))

inverting:

e(q) = S · ln(K / (K − q))

the marginal price, in ether per token, is the derivative:

p(e) = de/dq = S / (K − q) = (S/K) · exp(e/S)

the ether owed to a burner who returns b tokens, starting from current supply q, is the difference e(q) − e(q − b):

Δe(q, b) = S · ln((K − q + b) / (K − q))

these formulas are computed on-chain in PRBMath UD60x18 fixed-point arithmetic. we choose K = 21,000,000 (the bitcoin lineage) and S = 500 ether (sato's parameter). these choices imply a marginal price of approximately 2.4 × 10⁻⁵ ether per token at deployment, growing exponentially in e. reachable supply is bounded near 20.5 million; the curve becomes prohibitively expensive past e ≈ 2,300 ether.

§ 3the multiplier

let R denote the current ether-value of the wsteth reserve. that is, R = (wsteth balance) · (eth-per-wsteth peg). define:

m = R / e

with the convention m = 1 at deployment, when e = R = 0. the ratchet has three invariants.

claim 1. every mint preserves m.

m′ = (R + dETH) / (e + dETH/m)
   = (me + dETH) / (e + dETH/m)
   = m · (me + dETH) / (me + dETH)
   = m.   ∎

claim 2. every burn preserves m.

m′ = (R − m · Δe) / (e − Δe)
   = (me − m · Δe) / (e − Δe)
   = m · (e − Δe) / (e − Δe)
   = m.   ∎

claim 3. between transactions, m is non-decreasing.

§ 4issuance mechanics

the bonding curve is a uniswap v4 pool whose pair is eth and pawl, with a custom hook attached. the hook is the only address with mint authority on the pawl contract; the mint authority is set at deployment of the hook and cannot be transferred. the mint flow, in pseudocode:

// hook.beforeSwap — eth → pawl direction
require(params.zeroForOne)
require(params.amount <= 5 ether)
require(block.number > lastMintBlock[sender])

dETH      = params.amount
fee       = dETH × 30 / 10000           // 0.3%
netETH    = dETH − fee

wrapETHToWstETH(dETH)                   // fee remains in reserve

de        = netETH / m                  // m = currentMultiplier()
e_new     = e + de
tokensOut = q(e_new) − q(e)

if block.number − deployBlock < 100:
    tokensOut ×= randomFactor()         // PREVRANDAO ∈ [0.9, 1.1]

e = e_new
lastMintBlock[sender] = block.number
mint(sender, tokensOut)

the burn flow is mirror-symmetric, with one additional check:

// hook.beforeSwap — pawl → eth direction
require(!params.zeroForOne)
require(block.number > lastMintBlock[sender])    // no same-block burn

b           = params.amount
Δe          = S · ln((K − q + b) / (K − q))
ethOutGross = m · Δe
fee         = ethOutGross × 30 / 10000
ethOutNet   = ethOutGross − fee

unwrapWstETHToETH(ethOutGross)
burn(sender, b)
e = e − Δe
transfer(sender, ethOutNet)

the wsteth balance held by the hook serves three purposes at once: backing for burn redemptions, yield-bearing substrate for the multiplier, and accumulator for the 0.3% protocol fee. all three accrue or deplete in proportion.

§ 5pricing examples

at deployment (e = 0, m = 1), the marginal price is

p(0) = 500 / 21,000,000 ≈ 2.381 × 10⁻⁵  eth/pawl

a 1 eth mint at deployment advances the curve to e = 1, yielding

q(1) − q(0) = 21M · (1 − exp(−1/500))
            ≈ 21M · 0.001998
            ≈ 41,958 pawl

average price per token: ≈ 2.384 × 10⁻⁵ eth. at e = 500 (one S-length in), with m still equal to 1, the marginal price has grown by a factor of e ≈ 2.718:

p(500) = (500 / 21M) · exp(1)
       ≈ 6.47 × 10⁻⁵  eth/pawl

after thirty years of dormancy at 3% annual lido yield, m has drifted to (1.03)³⁰ ≈ 2.43. consider a burn of 10,000 pawl from a curve at supply q = 14,000,000:

Δe = 500 · ln((21M − 14M + 10000) / (21M − 14M))
   = 500 · ln(7,010,000 / 7,000,000)
   ≈ 500 · 0.001428
   ≈ 0.7141 eth-equivalent

payout = m · Δe ≈ 2.43 · 0.7141
       ≈ 1.735 eth, less 0.3% fee ≈ 1.730 eth

the same burn executed at deployment would have returned ≈ 0.712 eth after fee. the difference is the work the ratchet has done over thirty years.

§ 6game-theoretic guards

three constraints protect the curve from attacks.

per-tx mint cap. no single mint may exceed 5 ether. this prevents an attacker from vacuuming a meaningful fraction of cheap early supply in a single transaction or block. it forces large positions to be built over many transactions, exposing them to competing mints and to the rising marginal cost of the curve. the cap is a constant; it does not scale with m, by design — early supply is the cheapest supply, and large early grabs are the attack we are designing against.

same-block burn revert. if a sender minted in block N, any burn from that sender in block N reverts. this neutralizes flash-loan arbitrage: an attacker cannot mint at p(e) and immediately burn at p(e + de) within a single block to extract the curve slope. the cheapest viable strategy requires holding inventory across at least one block, which exposes the attacker to mempool competition and to the next block's price changes.

opening-window randomizer. for the first 100 blocks after the hook is deployed, every mint receives a random multiplier r ∈ [0.9, 1.1] applied to the tokens-out figure. r is drawn from PREVRANDAO. expected r is 1.0, so the randomizer imposes no expected loss on a uniformly distributed buyer; it imposes a 10% standard deviation. for bots optimized to mint at the exact deployment block — where the curve price is lowest — the randomizer is a tax. their advantage over later buyers is partially competed away by variance. after block 100, mints are fully deterministic.

each guard has a cost. the per-tx cap reduces capital efficiency for whales. the same-block burn revert prevents some legitimate same-block strategies. the opening window costs honest early buyers up to ±10% in nominal allocation. these costs are accepted in exchange for the gaming reductions they buy.

§ 7risks and limitations

lido slashing. the multiplier's monotonicity (claim 3) assumes the wsteth-eth peg is non-decreasing. lido validators can be slashed for double-signing or extended downtime, in which case the peg falls. historically, lido has experienced no slashing events of material size; the protocol distributes validator risk across hundreds of independent operators and maintains a slashing insurance buffer. but the risk is not zero. in a sufficiently large event, m would decrease. burners after the event would receive less ether than burners before.

wsteth-eth peg deviation. even without slashing, the market price of wsteth can deviate from its intrinsic value (wsteth balance · steth-per-wsteth · eth-per-steth). during the events of mid-2022, wsteth traded at discounts of up to 7%. for pawl this matters at the moment of wrap and unwrap: a burner unwrapping during a depeg event receives less ether than the on-chain m would suggest. the pricing in § 4 uses the live exchange rate at transaction time; persistent depegs would persistently understate or overstate the realized m.

curve precision. PRBMath UD60x18 provides 18 decimal places of fixed-point precision. for q close to K, the term (K − q) becomes small, and small absolute errors translate to larger relative errors in burn payouts. the practical reachable supply (q ≈ 20.5M, leaving K − q ≈ 0.5M) sits well within safe precision bounds.

lido smart-contract risk. pawl's reserve sits inside lido. a critical bug in the lido contracts could compromise the reserve. lido has been audited extensively and has been live since 2020 without major incident; the residual risk is comparable to other long-running ethereum protocols.

regulatory. this paper takes no position on the legal status of pawl in any jurisdiction. potential issuers, holders, and users are responsible for their own compliance.

§ 8trading regimes

during bootstrap, the curve is the only path to pawl. each new buyer mints; each seller burns. supply expansion and price discovery happen in lockstep with the curve formula.

once secondary AMM pools — for example, a pawl/usdt v4 pool with conventional liquidity — accumulate sufficient depth, secondary becomes the primary trading venue. the curve's role narrows: canonical issuer when secondary price exceeds m · p(e); buyer of last resort when no one bids on secondary above the inverse curve.

this is the mature regime. the curve mints supply only when arbitrage flows make it profitable to mint at curve price and immediately sell on secondary. as time passes and m drifts upward, the bar for that arbitrage rises with it. successful mints continue to push e forward, raising the cost basis for future issuance. the curve eventually becomes dormant: still a backstop, still ratcheting, but no longer the active price-setter.

§ 9routing and rails

the bonding curve is a uniswap v4 pool — specifically, a pool whose key (token0 = eth, token1 = pawl, fee = 3000, tickSpacing = 60, hooks = PawlHook) is registered with the canonical PoolManager. the secondary pawl/usdt market is a separate v4 pool with no hook (token0 = pawl, token1 = usdt, fee = 500, tickSpacing = 10, hooks = 0). they share the same PoolManager but they are not the same pool.

a trade routes through the curve only when its pool key is selected. wallets that target the curve pool by key — including direct contract calls and routers that explicitly include the hook in their path — will mint and burn against the curve. wallets that quote the secondary pool will trade against amm liquidity instead.

most exchanges that list pawl will not route through the curve. they will route through dex aggregators (1inch, 0x, paraswap, the uniswap router), which call into PoolManager. aggregators that support v4 with custom hooks can discover the curve pool and quote it; those that don't will quote only the secondary pool. burn pressure does not propagate to the curve through these venues — burning is a property of swapping through the hook-attached pool, not a property of selling pawl.

§ 10deprecation

mint cost grows in two dimensions: in e (the curve position) and in t (the multiplier drift). the marginal cost of issuance is

cost(e, t) = m(t) · p(e) = m(t) · (S/K) · exp(e/S)

eventually this exceeds the market price of pawl, and minting halts. the curve becomes dormant. burns continue to redeem against the reserve. m continues to drift upward whether or not anyone is minting.

the dormant regime is not the end of the contract — it is the state in which the ratchet does its slowest, most patient work. holders who hold through long dormancy receive a slowly compounding ether-denominated payout if they eventually burn.

§ 11parameters

§ 12references

1. sato. whitepaper, version 2.0. sat0.org/whitepaper
2. S. Nakamoto. Bitcoin: a peer-to-peer electronic cash system. 2008.
3. H. Adams, N. Zinsmeister, M. Salem, et al. Uniswap v4 Core. 2024. github.com/Uniswap/v4-core
4. Lido on Ethereum: wsteth (wrapped staked ether). protocol documentation. docs.lido.fi
5. P. R. Berg. PRBMath: Solidity library for fixed-point arithmetic. github.com/PaulRBerg/prb-math